CVE-2026-62390: Apache Kylin SQL Injection Vulnerability

CVE-2026-62390 Overview

CVE-2026-62390 is a SQL injection vulnerability in Apache Kylin, an open-source distributed analytics engine. The flaw resides in a backend API responsible for refreshing the table catalog. Attacker-controlled input reaches a dynamically constructed SQL statement without proper neutralization of special elements [CWE-89]. The issue affects Apache Kylin versions 4 through 5.0.3, and Apache has published a fix in version 5.0.4.

Critical Impact
Unauthenticated network attackers can inject arbitrary SQL through the table catalog refresh API, leading to confidentiality, integrity, and availability compromise of the underlying data store.

Affected Products

Apache Kylin 4.x
Apache Kylin 5.0.0 through 5.0.3
Deployments exposing the table catalog refresh backend API

Discovery Timeline

2026-07-14 - CVE CVE-2026-62390 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-62390

Vulnerability Analysis

Apache Kylin exposes a backend API that refreshes table catalog metadata. During request handling, the API concatenates user-supplied parameters into a SQL statement issued against the metadata source. The application does not neutralize SQL metacharacters or use parameterized queries. Attackers can submit crafted input that alters the query structure and executes arbitrary SQL clauses within the database session used by Kylin.

The vulnerability is reachable over the network without prior authentication. Exploitation requires only the ability to send HTTP requests to the affected endpoint. Successful injection allows an attacker to read, modify, or delete records accessible to the Kylin service account, and in many deployments to enumerate connected data sources through Kylin's metadata catalog.

Root Cause

The root cause is improper neutralization of special elements used in a SQL command [CWE-89]. The catalog refresh handler constructs SQL through string concatenation rather than binding parameters through prepared statements. Any untrusted input traversing this code path becomes executable SQL syntax when the query is dispatched to the backing store.

Attack Vector

Remote attackers reach the vulnerable endpoint over HTTP against a Kylin instance. The attacker submits a request to the table catalog refresh API with payload data crafted to break out of the intended SQL literal or identifier context. The injected fragment executes with the privileges of the Kylin database user. No user interaction is required, and no privileges are needed to initiate the request.

See the Apache Mailing List Discussion and the Openwall OSS-Security Update for the vendor's technical description.

Detection Methods for CVE-2026-62390

Indicators of Compromise

HTTP requests to Kylin backend endpoints associated with table catalog refresh containing SQL metacharacters such as single quotes, semicolons, UNION, --, or /* in parameter values.
Anomalous SQL statements originating from the Kylin service account in database audit logs, especially statements referencing information_schema or system catalogs.
Outbound network connections from Kylin hosts to unfamiliar destinations following catalog refresh activity.
Kylin application logs recording catalog refresh errors, malformed SQL exceptions, or unexpected result set sizes.

Detection Strategies

Inspect web server and reverse proxy logs for requests to Kylin REST endpoints containing encoded SQL syntax and correlate with the request source IP and User-Agent.
Enable database query auditing on the metadata store and alert on statements executed by the Kylin user that deviate from the known catalog refresh query template.
Deploy signatures on network security tooling to flag SQL injection payload patterns targeting /kylin/api/ paths.

Monitoring Recommendations

Baseline the volume and structure of catalog refresh API calls and alert on statistical deviations.
Forward Kylin application logs, HTTP access logs, and database audit logs to a central analytics platform for correlation.
Track version identifiers of deployed Kylin instances and alert when any node reports a version between 4.0.0 and 5.0.3.

How to Mitigate CVE-2026-62390

Immediate Actions Required

Upgrade all Apache Kylin instances to version 5.0.4 or later, which contains the vendor fix.
Restrict network access to Kylin backend APIs so that only trusted management networks can reach the catalog refresh endpoint.
Rotate credentials used by Kylin to connect to metadata and data sources if exploitation is suspected.
Review database audit logs and Kylin application logs for evidence of injection attempts covering the exposure window.

Patch Information

Apache has released Apache Kylin 5.0.4, which remediates the SQL injection in the catalog refresh API. Users on any release from 4.0 through 5.0.3 must upgrade. Reference the Apache Mailing List Discussion for the official announcement.

Workarounds

Place the Kylin API behind an authenticating reverse proxy that enforces allow-listed source addresses until patching is complete.
Configure a web application firewall to block SQL injection patterns targeting Kylin catalog endpoints.
Reduce the privileges of the database account used by Kylin to the minimum required for metadata operations, limiting the blast radius of a successful injection.

bash

# Verify installed Apache Kylin version and confirm upgrade to 5.0.4
$KYLIN_HOME/bin/kylin.sh version
# Expected output should indicate: Apache Kylin 5.0.4 or later